fix(oidc): respect role assertion and idTokenInfo flags and trigger preAccessToken trigger (#8046)

# Which Problems Are Solved

After deployment of 2.53.x, customers noted that the roles claims where
always present in the tokens even if the corresponding option on the
client (accessTokenRoleAssertion, idTokenRoleAsseriton) was disabled.
Only the project flag (assertRolesOnAuthentication) would be considered.

Further it was noted, that the action on the preAccessTokenCreation
trigger would not be executed.

Additionally, while testing those issues we found out, that the user
information (name, givenname, family name, ...) where always present in
the id_token even if the option (idTokenUserInfo) was not enabled.

# How the Problems Are Solved

- The `getUserinfoOnce` which was used for access and id_tokens is
refactored to `getUserInfo` and no longer only queries the info once
from the database, but still provides a mechanism to be reused for
access and id_token where the corresponding `roleAssertion` and action
`triggerType` can be passed.
- `userInfo` on the other hand now directly makes sure the information
is only queried once from the database. Role claims are asserted every
time and action triggers are executed on every call.
- `userInfo` now also checks if the profile information need to be
returned.

# Additional Changes

None.

# Additional Context

- relates to #7822 
- reported by customers

internal/api/oidc/userinfo_test.go

@@ -3,7 +3,6 @@ package oidc
 import (
 	"context"
 	"encoding/base64"
-	"fmt"
 	"testing"
 	"time"
 
@@ -267,11 +266,9 @@ func Test_userInfoToOIDC(t *testing.T) {
 	}
 
 	type args struct {
-		projectID      string
-		user           *query.OIDCUserInfo
-		scope          []string
-		roleAudience   []string
-		requestedRoles []string
+		user              *query.OIDCUserInfo
+		userInfoAssertion bool
+		scope             []string
 	}
 	tests := []struct {
 		name string
@@ -281,25 +278,22 @@ func Test_userInfoToOIDC(t *testing.T) {
 		{
 			name: "human, empty",
 			args: args{
-				projectID: "project1",
-				user:      humanUserInfo,
+				user: humanUserInfo,
 			},
 			want: &oidc.UserInfo{},
 		},
 		{
 			name: "machine, empty",
 			args: args{
-				projectID: "project1",
-				user:      machineUserInfo,
+				user: machineUserInfo,
 			},
 			want: &oidc.UserInfo{},
 		},
 		{
 			name: "human, scope openid",
 			args: args{
-				projectID: "project1",
-				user:      humanUserInfo,
-				scope:     []string{oidc.ScopeOpenID},
+				user:  humanUserInfo,
+				scope: []string{oidc.ScopeOpenID},
 			},
 			want: &oidc.UserInfo{
 				Subject: "human1",
@@ -308,20 +302,19 @@ func Test_userInfoToOIDC(t *testing.T) {
 		{
 			name: "machine, scope openid",
 			args: args{
-				projectID: "project1",
-				user:      machineUserInfo,
-				scope:     []string{oidc.ScopeOpenID},
+				user:  machineUserInfo,
+				scope: []string{oidc.ScopeOpenID},
 			},
 			want: &oidc.UserInfo{
 				Subject: "machine1",
 			},
 		},
 		{
-			name: "human, scope email",
+			name: "human, scope email, profileInfoAssertion",
 			args: args{
-				projectID: "project1",
-				user:      humanUserInfo,
-				scope:     []string{oidc.ScopeEmail},
+				user:              humanUserInfo,
+				userInfoAssertion: true,
+				scope:             []string{oidc.ScopeEmail},
 			},
 			want: &oidc.UserInfo{
 				UserInfoEmail: oidc.UserInfoEmail{
@@ -331,22 +324,29 @@ func Test_userInfoToOIDC(t *testing.T) {
 			},
 		},
 		{
-			name: "machine, scope email",
+			name: "human, scope email",
 			args: args{
-				projectID: "project1",
-				user:      machineUserInfo,
-				scope:     []string{oidc.ScopeEmail},
+				user:  humanUserInfo,
+				scope: []string{oidc.ScopeEmail},
+			},
+			want: &oidc.UserInfo{},
+		},
+		{
+			name: "machine, scope email, profileInfoAssertion",
+			args: args{
+				user:  machineUserInfo,
+				scope: []string{oidc.ScopeEmail},
 			},
 			want: &oidc.UserInfo{
 				UserInfoEmail: oidc.UserInfoEmail{},
 			},
 		},
 		{
-			name: "human, scope profile",
+			name: "human, scope profile, profileInfoAssertion",
 			args: args{
-				projectID: "project1",
-				user:      humanUserInfo,
-				scope:     []string{oidc.ScopeProfile},
+				user:              humanUserInfo,
+				userInfoAssertion: true,
+				scope:             []string{oidc.ScopeProfile},
 			},
 			want: &oidc.UserInfo{
 				UserInfoProfile: oidc.UserInfoProfile{
@@ -363,11 +363,11 @@ func Test_userInfoToOIDC(t *testing.T) {
 			},
 		},
 		{
-			name: "machine, scope profile",
+			name: "machine, scope profile, profileInfoAssertion",
 			args: args{
-				projectID: "project1",
-				user:      machineUserInfo,
-				scope:     []string{oidc.ScopeProfile},
+				user:              machineUserInfo,
+				userInfoAssertion: true,
+				scope:             []string{oidc.ScopeProfile},
 			},
 			want: &oidc.UserInfo{
 				UserInfoProfile: oidc.UserInfoProfile{
@@ -378,11 +378,19 @@ func Test_userInfoToOIDC(t *testing.T) {
 			},
 		},
 		{
-			name: "human, scope phone",
+			name: "machine, scope profile",
 			args: args{
-				projectID: "project1",
-				user:      humanUserInfo,
-				scope:     []string{oidc.ScopePhone},
+				user:  machineUserInfo,
+				scope: []string{oidc.ScopeProfile},
+			},
+			want: &oidc.UserInfo{},
+		},
+		{
+			name: "human, scope phone, profileInfoAssertion",
+			args: args{
+				user:              humanUserInfo,
+				userInfoAssertion: true,
+				scope:             []string{oidc.ScopePhone},
 			},
 			want: &oidc.UserInfo{
 				UserInfoPhone: oidc.UserInfoPhone{
@@ -391,12 +399,19 @@ func Test_userInfoToOIDC(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "human, scope phone",
+			args: args{
+				user:  humanUserInfo,
+				scope: []string{oidc.ScopePhone},
+			},
+			want: &oidc.UserInfo{},
+		},
 		{
 			name: "machine, scope phone",
 			args: args{
-				projectID: "project1",
-				user:      machineUserInfo,
-				scope:     []string{oidc.ScopePhone},
+				user:  machineUserInfo,
+				scope: []string{oidc.ScopePhone},
 			},
 			want: &oidc.UserInfo{
 				UserInfoPhone: oidc.UserInfoPhone{},
@@ -405,9 +420,8 @@ func Test_userInfoToOIDC(t *testing.T) {
 		{
 			name: "human, scope metadata",
 			args: args{
-				projectID: "project1",
-				user:      humanUserInfo,
-				scope:     []string{ScopeUserMetaData},
+				user:  humanUserInfo,
+				scope: []string{ScopeUserMetaData},
 			},
 			want: &oidc.UserInfo{
 				Claims: map[string]any{
@@ -421,18 +435,16 @@ func Test_userInfoToOIDC(t *testing.T) {
 		{
 			name: "machine, scope metadata, none found",
 			args: args{
-				projectID: "project1",
-				user:      machineUserInfo,
-				scope:     []string{ScopeUserMetaData},
+				user:  machineUserInfo,
+				scope: []string{ScopeUserMetaData},
 			},
 			want: &oidc.UserInfo{},
 		},
 		{
 			name: "machine, scope resource owner",
 			args: args{
-				projectID: "project1",
-				user:      machineUserInfo,
-				scope:     []string{ScopeResourceOwner},
+				user:  machineUserInfo,
+				scope: []string{ScopeResourceOwner},
 			},
 			want: &oidc.UserInfo{
 				Claims: map[string]any{
@@ -445,9 +457,8 @@ func Test_userInfoToOIDC(t *testing.T) {
 		{
 			name: "human, scope org primary domain prefix",
 			args: args{
-				projectID: "project1",
-				user:      humanUserInfo,
-				scope:     []string{domain.OrgDomainPrimaryScope + "foo.com"},
+				user:  humanUserInfo,
+				scope: []string{domain.OrgDomainPrimaryScope + "foo.com"},
 			},
 			want: &oidc.UserInfo{
 				Claims: map[string]any{
@@ -458,9 +469,8 @@ func Test_userInfoToOIDC(t *testing.T) {
 		{
 			name: "machine, scope org id",
 			args: args{
-				projectID: "project1",
-				user:      machineUserInfo,
-				scope:     []string{domain.OrgIDScope + "orgID"},
+				user:  machineUserInfo,
+				scope: []string{domain.OrgIDScope + "orgID"},
 			},
 			want: &oidc.UserInfo{
 				Claims: map[string]any{
@@ -471,50 +481,11 @@ func Test_userInfoToOIDC(t *testing.T) {
 				},
 			},
 		},
-		{
-			name: "human, roleAudience",
-			args: args{
-				projectID:    "project1",
-				user:         humanUserInfo,
-				roleAudience: []string{"project1"},
-			},
-			want: &oidc.UserInfo{
-				Claims: map[string]any{
-					ClaimProjectRoles: projectRoles{
-						"role1": {"orgID": "orgDomain"},
-						"role2": {"orgID": "orgDomain"},
-					},
-					fmt.Sprintf(ClaimProjectRolesFormat, "project1"): projectRoles{
-						"role1": {"orgID": "orgDomain"},
-						"role2": {"orgID": "orgDomain"},
-					},
-				},
-			},
-		},
-		{
-			name: "human, requested roles",
-			args: args{
-				projectID:      "project1",
-				user:           humanUserInfo,
-				roleAudience:   []string{"project1"},
-				requestedRoles: []string{"role2"},
-			},
-			want: &oidc.UserInfo{
-				Claims: map[string]any{
-					ClaimProjectRoles: projectRoles{
-						"role2": {"orgID": "orgDomain"},
-					},
-					fmt.Sprintf(ClaimProjectRolesFormat, "project1"): projectRoles{
-						"role2": {"orgID": "orgDomain"},
-					},
-				},
-			},
-		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			assetPrefix := "https://foo.com/assets"
-			got := userInfoToOIDC(tt.args.projectID, tt.args.user, tt.args.scope, tt.args.roleAudience, tt.args.requestedRoles, assetPrefix)
+			got := userInfoToOIDC(tt.args.user, tt.args.userInfoAssertion, tt.args.scope, assetPrefix)
 			assert.Equal(t, tt.want, got)
 		})
 	}